Re: computeraccount in admingroup?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

I'm going to have to test this out, I was not aware that anyone but admins
or special privileged accounts could do this.

Thanks for the info.

--

Paul Bergson MCT, MCSE, MCSA, CNE, CNA, CCA

This posting is provided "AS IS" with no warranties, and confers no rights.

"Joe Richards [MVP]" <humorexpress@xxxxxxxxxxx> wrote in message
news:%23KOHb2sGGHA.2704@xxxxxxxxxxxxxxxxxxxxxxx
> Nope, power users have sufficient rights to escalate to localsystem.
>
> A regular user could possibly do it depending on what is in place on the
> system and how patched it is.
>
> Windows security is so so once you are interactively on the machine. If
> you can run local code and/or modify system files you are in good shape to
> do what you want to the machine. Most of Windows security is to prevent
> you from getting into the machine directly and instead only give you
> interfaces to specific parts that are safe to allow non-admins to use.
>
>
>
> --
> Joe Richards Microsoft MVP Windows Server Directory Services
> www.joeware.net
>
>
> Paul Bergson wrote:
>> I guess that is correct but they will have to have significant rights to
>> spawn the task as a system account. I have only seen local admins do
>> this, but I'm sure you can tweak rights to do this. So no average user
>> or power user on this server is going to be able to do this only
>> adminstrating type accounts.
>>
>>

.

Relevant Pages

  • Re: Emails going to the wrong place
    ... As far as rights go for admins of resources, unless they need to pretend to ... just Full Mailbox rights in the Exchange Advanced->Mailbox Rights ... in other cases customer service type accounts). ...
    (microsoft.public.exchange.misc)
  • Deny account admins rights to change mailbox permissions
    ... I need to give admins the rights to add and create Exchange accounts ... I have already delegated accounts admins rights to the users OU giving ... Exchange View only admin rights, they are allowed to create mailboxes, ...
    (microsoft.public.exchange.admin)
  • Re: User rights
    ... Power Users ... > accounts with more rights then Limited users but less ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Exchange 5.5 to 2003 migration questions
    ... That usually means you do not have the correct accounts listed on the ... So if you brought up AD Users and Computers from the Exchange server you ... This posting is provided "AS IS" with no warranties, and confers no rights. ...
    (microsoft.public.exchange.admin)
  • Re: help with setting up File Access Rights in Windows 2003
    ... > I need to allow access to Accounts to the Accounts Team and so on. ... > I set up a security group called Accts and pulled the 2 accts people ... > rights and assigned Full rights to the administrator and the Accts ... > If however I allow inherited rights from above, ...
    (microsoft.public.win2000.security)